← Years 9–10 Digital Systems

Trust boundaries

A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 74, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 75, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 143, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 46, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 33, WA Computer Science ATAR Year 11 — Network Communications — Module 96, WA Computer Science ATAR Year 11 — Cyber Security — Module 136

Understanding Trust boundaries in Years 9–10 Digital Systems

What it does: Input from outside the boundary is untrusted, so the server checks it with validation before using it. A threat model table lists each boundary and the threats that target it, because attackers focus where data crosses between trust levels. The boundary is the idea of a change in trust. Controls such as firewalls or validation are added at the boundary, but they are not the boundary itself.

Common mistakes: A trust boundary sits between two parts of a system with different trust levels. Using zone1 twice puts it between the same zone. It should be boundary(zone1, zone2), between the internet and the web server. The database holds sensitive data, so it has a HIGH trust level. If both sides were LOW, trust would not differ and no boundary would be marked. It should be trust(database) <- HIGH.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Trust boundaries to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does a trust boundary show on a data flow diagram?
Where the fastest part of the system is locatedWhere data passes between parts with different levels of trust
Matches
Trust boundary = a firewall device only
↓
A trust boundary is a line on a diagram, not just a device. It marks where trust levels change, and a firewall is only one control placed there.
Applying
Meanings
Term
trust boundary
Meaning
A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.
Practice
Internet -> | trust boundary | -> Web server
Testing
Gaps
Draw a between them
Check Answer
Spots
2zone2 <- 'Web server'
3b <- boundary(zone1, zone1)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Tree Frog' badge — Leap of Logic, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does a trust boundary show on a data flow diagram?
A. Where the fastest part of the system is located
B. Where data passes between parts with different levels of trust ✓
A trust boundary is a line marking where data crosses between parts of a system that are trusted to different degrees.
2. Which data flow crosses a trust boundary?
A. A user's phone sending a login request to a web server ✓
B. A function reading a variable inside the same program
A phone on the internet is less trusted than the server, so data moving between them crosses a trust boundary.
3. Data travels from the internet to your school's web server. How should the server treat that data?
A. As untrusted until it has been checked ✓
B. As safe because it came from a logged-in user
Data crossing in from the internet is untrusted. The server should validate it, because even a logged-in user could send harmful input.
4. Where do threats tend to cluster in a system?
A. In the middle of the most trusted zone
B. At the trust boundaries ✓
Attackers target the points where data enters from a less trusted area, so trust boundaries need the strongest controls.
5. Between which two parts is there usually a trust boundary?
A. Web server and database ✓
B. Two files stored in the same folder
The web server handles outside input, while the database holds valuable data. Data passing between them crosses a boundary, which is why SQL injection is a risk here.

Match the Pairs

Browser -|- Web server → A trust boundary where data moves from the untrusted internet into the web server
Web server -|- Database → A trust boundary where the web server passes requests to a more protected database
Data from a user's device must be checked when it crosses the boundary into the server → if not valid(user_input): reject()
Threats cluster at trust boundaries, so each boundary crossing is listed in a threat model → Boundary: Internet to Web server | Threat: SQL injection
Trust boundary = a firewall device only → A trust boundary is a line on a diagram, not just a device. It marks where trust levels change, and a firewall is only one control placed there.
Web server to Database: no boundary, all trusted → The database holds the most sensitive data and has a higher trust level than the web server, so a trust boundary exists here and must be drawn and protected.

Key Term

trust boundary
A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

Fill in the Blanks

1. Internet -> Web Server Draw a trust boundary between them
Hint: Type the two-word name for the line where data passes between parts with different trust levels.
2. Web Server -> Database Data crosses a trust boundary here
Hint: Type the part of the system that stores the data and sits behind the web server.
3. Internet -> Web Server -> Database Threats cluster at each trust boundary
Hint: Type the verb that describes threats bunching together at boundaries.
4. Internet -> Web Server At the trust boundary: validate all input
Hint: Type the action you take on incoming data at a boundary to block bad input.
5. Browser -> Web Server Data flow crosses a trust boundary
Hint: Type the symbol that shows the direction data flows between two parts.

Spot the Error

Question 1
A zone1 <- 'Internet'
B zone2 <- 'Web server'
C b <- boundary(zone1, zone1)
D PRINT 'Check data at', b
Line C — A trust boundary sits between two parts of a system with different trust levels. Using zone1 twice puts it between the same zone. It should be boundary(zone1, zone2), between the internet and the web server.
Question 2
A trust(internet) <- LOW
B trust(database) <- LOW
C IF trust differs THEN
D mark boundary
Line B — The database holds sensitive data, so it has a HIGH trust level. If both sides were LOW, trust would not differ and no boundary would be marked. It should be trust(database) <- HIGH.
Question 3
A data <- READ form from user
B // internet to web server
C IF NOT valid(data) THEN
D accept(data)
E ELSE save(data)
Line D — Data that fails validation as it crosses the boundary must be rejected, not accepted. Line 4 should be reject(data).
Question 4
A name <- request.name
B clean <- escape(name)
C query <- 'WHERE n=' + name
D run(db, query)
Line C — The query is built from the raw name, so it skips the cleaned input. Untrusted data crossing from the web server to the database could then cause SQL injection. It should be query <- prepare(clean).
Question 5
A boundaries <- list_all()
B FOR EACH b IN zones
C add_checks(b)
D log_traffic(b)
Line B — Threats cluster at trust boundaries, so the loop should go through the boundaries list. The variable zones is not defined. It should be FOR EACH b IN boundaries.

Student with a class code? Join your class →